Skip to content

What is Subprocessor?

A subprocessor is a third party that a processor engages to carry out part of the processing of personal data on the controller’s behalf — a hosting provider, a payment provider or an email relay, for example.

Updated

  • Sub-processor
Each subprocessor is bound by terms no weaker than the processor’s own.

Compliance

Subprocessor, explained

The chain matters because the controller’s obligations do not stop at the first vendor. Article 28 requires the processor to impose the same data protection terms on anybody it engages, and to remain fully liable to the controller for what that party does. A vendor cannot subcontract away a duty it owes.

Two forms of authorisation exist. Specific authorisation means the controller approves each subprocessor individually, which is thorough and unworkable at scale. General authorisation means the controller approves the practice in advance on condition of being notified of changes and given a right to object, which is what nearly every SaaS contract uses. The value of general authorisation depends entirely on the notice period actually being honoured.

How Enclessa uses it

Enclessa maintains a subprocessor list covering hosting, payments, transactional email and operational tooling, and commits to keeping the DPA annex and the privacy notice in step with each other. The specific entities and the notice period are recorded on the security page.